9.8
CVE-2016-2786
- EPSS 0.71%
- Published 10.06.2016 15:59:01
- Last modified 12.04.2025 10:46:40
- Source cve@mitre.org
- Teams watchlist Login
- Open Login
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.
Data is provided by the National Vulnerability Database (NVD)
Puppet ≫ Puppet Agent Version1.3.0
Puppet ≫ Puppet Agent Version1.3.1
Puppet ≫ Puppet Agent Version1.3.2
Puppet ≫ Puppet Agent Version1.3.4
Puppet ≫ Puppet Agent Version1.3.5
Puppet ≫ Puppet Enterprise Version2015.3.0
Puppet ≫ Puppet Enterprise Version2015.3.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.71% | 0.699 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.